# generated by datamodel-codegen:
#   timestamp: 2024-04-28T19:06:26+00:00
#   k8s version: v1.30.0

from __future__ import annotations

from typing import List, Optional

from pydantic import BaseModel, Field

from ...apimachinery.pkg.apis.meta import v1


class AuditAnnotation(BaseModel):
    key: str = Field(
        ...,
        description=(
            "key specifies the audit annotation key. The audit annotation keys of a"
            " ValidatingAdmissionPolicy must be unique. The key must be a qualified"
            " name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length.\n\nThe"
            " key is combined with the resource name of the ValidatingAdmissionPolicy"
            ' to construct an audit annotation key: "{ValidatingAdmissionPolicy'
            ' name}/{key}".\n\nIf an admission webhook uses the same resource name as'
            " this ValidatingAdmissionPolicy and the same audit annotation key, the"
            " annotation key will be identical. In this case, the first annotation"
            " written with the key will be included in the audit event and all"
            " subsequent annotations with the same key will be discarded.\n\nRequired."
        ),
    )
    valueExpression: str = Field(
        ...,
        description=(
            "valueExpression represents the expression which is evaluated by CEL to"
            " produce an audit annotation value. The expression must evaluate to either"
            " a string or null value. If the expression evaluates to a string, the"
            " audit annotation is included with the string value. If the expression"
            " evaluates to null or empty string the audit annotation will be omitted."
            " The valueExpression may be no longer than 5kb in length. If the result of"
            " the valueExpression is more than 10kb in length, it will be truncated to"
            " 10kb.\n\nIf multiple ValidatingAdmissionPolicyBinding resources match an"
            " API request, then the valueExpression will be evaluated for each binding."
            " All unique values produced by the valueExpressions will be joined"
            " together in a comma-separated list.\n\nRequired."
        ),
    )


class ExpressionWarning(BaseModel):
    fieldRef: str = Field(
        ...,
        description=(
            "The path to the field that refers the expression. For example, the"
            " reference to the expression of the first item of validations is"
            ' "spec.validations[0].expression"'
        ),
    )
    warning: str = Field(
        ...,
        description=(
            "The content of type checking information in a human-readable form. Each"
            " line of the warning contains the type that the expression is checked"
            " against, followed by the type check error from the compiler."
        ),
    )


class MatchCondition(BaseModel):
    expression: str = Field(
        ...,
        description=(
            "Expression represents the expression which will be evaluated by CEL. Must"
            " evaluate to bool. CEL expressions have access to the contents of the"
            " AdmissionRequest and Authorizer, organized into CEL"
            " variables:\n\n'object' - The object from the incoming request. The value"
            " is null for DELETE requests. 'oldObject' - The existing object. The value"
            " is null for CREATE requests. 'request' - Attributes of the admission"
            " request(/pkg/apis/admission/types.go#AdmissionRequest). 'authorizer' - A"
            " CEL Authorizer. May be used to perform authorization checks for the"
            " principal (user or service account) of the request.\n  See"
            " https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n'authorizer.requestResource'"
            " - A CEL ResourceCheck constructed from the 'authorizer' and configured"
            " with the\n  request resource.\nDocumentation on CEL:"
            " https://kubernetes.io/docs/reference/using-api/cel/\n\nRequired."
        ),
    )
    name: str = Field(
        ...,
        description=(
            "Name is an identifier for this match condition, used for strategic merging"
            " of MatchConditions, as well as providing an identifier for logging"
            " purposes. A good name should be descriptive of the associated expression."
            " Name must be a qualified name consisting of alphanumeric characters, '-',"
            " '_' or '.', and must start and end with an alphanumeric character (e.g."
            " 'MyName',  or 'my.name',  or '123-abc', regex used for validation is"
            " '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an optional DNS"
            " subdomain prefix and '/' (e.g. 'example.com/MyName')\n\nRequired."
        ),
    )


class NamedRuleWithOperations(BaseModel):
    apiGroups: Optional[List[str]] = Field(
        default=None,
        description=(
            "APIGroups is the API groups the resources belong to. '*' is all groups. If"
            " '*' is present, the length of the slice must be one. Required."
        ),
    )
    apiVersions: Optional[List[str]] = Field(
        default=None,
        description=(
            "APIVersions is the API versions the resources belong to. '*' is all"
            " versions. If '*' is present, the length of the slice must be one."
            " Required."
        ),
    )
    operations: Optional[List[str]] = Field(
        default=None,
        description=(
            "Operations is the operations the admission hook cares about - CREATE,"
            " UPDATE, DELETE, CONNECT or * for all of those operations and any future"
            " admission operations that are added. If '*' is present, the length of the"
            " slice must be one. Required."
        ),
    )
    resourceNames: Optional[List[str]] = Field(
        default=None,
        description=(
            "ResourceNames is an optional white list of names that the rule applies to."
            "  An empty set means that everything is allowed."
        ),
    )
    resources: Optional[List[str]] = Field(
        default=None,
        description=(
            "Resources is a list of resources this rule applies to.\n\nFor example:"
            " 'pods' means pods. 'pods/log' means the log subresource of pods. '*'"
            " means all resources, but not subresources. 'pods/*' means all"
            " subresources of pods. '*/scale' means all scale subresources. '*/*' means"
            " all resources and their subresources.\n\nIf wildcard is present, the"
            " validation rule will ensure resources do not overlap with each"
            " other.\n\nDepending on the enclosing object, subresources might not be"
            " allowed. Required."
        ),
    )
    scope: Optional[str] = Field(
        default=None,
        description=(
            'scope specifies the scope of this rule. Valid values are "Cluster",'
            ' "Namespaced", and "*" "Cluster" means that only cluster-scoped resources'
            " will match this rule. Namespace API objects are cluster-scoped."
            ' "Namespaced" means that only namespaced resources will match this rule.'
            ' "*" means that there are no scope restrictions. Subresources match the'
            ' scope of their parent resource. Default is "*".'
        ),
    )


class ParamKind(BaseModel):
    apiVersion: Optional[str] = Field(
        default=None,
        description=(
            "APIVersion is the API group version the resources belong to. In format of"
            ' "group/version". Required.'
        ),
    )
    kind: Optional[str] = Field(
        default=None,
        description="Kind is the API kind the resources belong to. Required.",
    )


class RuleWithOperations(BaseModel):
    apiGroups: Optional[List[str]] = Field(
        default=None,
        description=(
            "APIGroups is the API groups the resources belong to. '*' is all groups. If"
            " '*' is present, the length of the slice must be one. Required."
        ),
    )
    apiVersions: Optional[List[str]] = Field(
        default=None,
        description=(
            "APIVersions is the API versions the resources belong to. '*' is all"
            " versions. If '*' is present, the length of the slice must be one."
            " Required."
        ),
    )
    operations: Optional[List[str]] = Field(
        default=None,
        description=(
            "Operations is the operations the admission hook cares about - CREATE,"
            " UPDATE, DELETE, CONNECT or * for all of those operations and any future"
            " admission operations that are added. If '*' is present, the length of the"
            " slice must be one. Required."
        ),
    )
    resources: Optional[List[str]] = Field(
        default=None,
        description=(
            "Resources is a list of resources this rule applies to.\n\nFor example:"
            " 'pods' means pods. 'pods/log' means the log subresource of pods. '*'"
            " means all resources, but not subresources. 'pods/*' means all"
            " subresources of pods. '*/scale' means all scale subresources. '*/*' means"
            " all resources and their subresources.\n\nIf wildcard is present, the"
            " validation rule will ensure resources do not overlap with each"
            " other.\n\nDepending on the enclosing object, subresources might not be"
            " allowed. Required."
        ),
    )
    scope: Optional[str] = Field(
        default=None,
        description=(
            'scope specifies the scope of this rule. Valid values are "Cluster",'
            ' "Namespaced", and "*" "Cluster" means that only cluster-scoped resources'
            " will match this rule. Namespace API objects are cluster-scoped."
            ' "Namespaced" means that only namespaced resources will match this rule.'
            ' "*" means that there are no scope restrictions. Subresources match the'
            ' scope of their parent resource. Default is "*".'
        ),
    )


class ServiceReference(BaseModel):
    name: str = Field(..., description="`name` is the name of the service. Required")
    namespace: str = Field(
        ..., description="`namespace` is the namespace of the service. Required"
    )
    path: Optional[str] = Field(
        default=None,
        description=(
            "`path` is an optional URL path which will be sent in any request to this"
            " service."
        ),
    )
    port: Optional[int] = Field(
        default=None,
        description=(
            "If specified, the port on the service that hosting webhook. Default to 443"
            " for backward compatibility. `port` should be a valid port number"
            " (1-65535, inclusive)."
        ),
    )


class TypeChecking(BaseModel):
    expressionWarnings: Optional[List[ExpressionWarning]] = Field(
        default=None, description="The type checking warnings for each expression."
    )


class Validation(BaseModel):
    expression: str = Field(
        ...,
        description=(
            "Expression represents the expression which will be evaluated by CEL. ref:"
            " https://github.com/google/cel-spec CEL expressions have access to the"
            " contents of the API request/response, organized into CEL variables as"
            " well as some other useful variables:\n\n- 'object' - The object from"
            " the incoming request. The value is null for DELETE requests. -"
            " 'oldObject' - The existing object. The value is null for CREATE"
            " requests. - 'request' - Attributes of the API"
            " request([ref](/pkg/apis/admission/types.go#AdmissionRequest)). -"
            " 'params' - Parameter resource referred to by the policy binding being"
            " evaluated. Only populated if the policy has a ParamKind. -"
            " 'namespaceObject' - The namespace object that the incoming object"
            " belongs to. The value is null for cluster-scoped resources. -"
            " 'variables' - Map of composited variables, from its name to its lazily"
            " evaluated value.\n  For example, a variable named 'foo' can be accessed"
            " as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used"
            " to perform authorization checks for the principal (user or service"
            " account) of the request.\n  See"
            " https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n-"
            " 'authorizer.requestResource' - A CEL ResourceCheck constructed from the"
            " 'authorizer' and configured with the\n  request resource.\n\nThe"
            " `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are"
            " always accessible from the root of the object. No other metadata"
            " properties are accessible.\n\nOnly property names of the form"
            " `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible. Accessible property names"
            " are escaped according to the following rules when accessed in the"
            " expression: - '__' escapes to '__underscores__' - '.' escapes to"
            " '__dot__' - '-' escapes to '__dash__' - '/' escapes to"
            " '__slash__' - Property names that exactly match a CEL RESERVED keyword"
            ' escape to \'__{keyword}__\'. The keywords are:\n\t  "true", "false",'
            ' "null", "in", "as", "break", "const", "continue", "else", "for",'
            ' "function", "if",\n\t  "import", "let", "loop", "package", "namespace",'
            ' "return".\nExamples:\n  - Expression accessing a property named'
            ' "namespace": {"Expression": "object.__namespace__ > 0"}\n  - Expression'
            ' accessing a property named "x-prop": {"Expression": "object.x__dash__prop'
            ' > 0"}\n  - Expression accessing a property named "redact__d":'
            ' {"Expression": "object.redact__underscores__d > 0"}\n\nEquality on arrays'
            " with list type of 'set' or 'map' ignores element order, i.e. [1, 2]"
            " == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the"
            " semantics of the list type:\n  - 'set': `X + Y` performs a union where"
            " the array positions of all elements in `X` are preserved and\n   "
            " non-intersecting elements in `Y` are appended, retaining their partial"
            " order.\n  - 'map': `X + Y` performs a merge where the array positions"
            " of all keys in `X` are preserved but the values\n    are overwritten by"
            " values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y`"
            " with\n    non-intersecting keys are appended, retaining their partial"
            " order.\nRequired."
        ),
    )
    message: Optional[str] = Field(
        default=None,
        description=(
            "Message represents the message displayed when validation fails. The"
            " message is required if the Expression contains line breaks. The message"
            ' must not contain line breaks. If unset, the message is "failed rule:'
            ' {Rule}". e.g. "must be a URL with the host matching spec.host" If the'
            " Expression contains line breaks. Message is required. The message must"
            ' not contain line breaks. If unset, the message is "failed Expression:'
            ' {Expression}".'
        ),
    )
    messageExpression: Optional[str] = Field(
        default=None,
        description=(
            "messageExpression declares a CEL expression that evaluates to the"
            " validation failure message that is returned when this rule fails. Since"
            " messageExpression is used as a failure message, it must evaluate to a"
            " string. If both message and messageExpression are present on a"
            " validation, then messageExpression will be used if validation fails. If"
            " messageExpression results in a runtime error, the runtime error is"
            " logged, and the validation failure message is produced as if the"
            " messageExpression field were unset. If messageExpression evaluates to an"
            " empty string, a string with only spaces, or a string that contains line"
            " breaks, then the validation failure message will also be produced as if"
            " the messageExpression field were unset, and the fact that"
            " messageExpression produced an empty string/string with only spaces/string"
            " with line breaks will be logged. messageExpression has access to all the"
            " same variables as the `expression` except for 'authorizer' and"
            " 'authorizer.requestResource'. Example: \"object.x must be less than max"
            ' ("+string(params.max)+")"'
        ),
    )
    reason: Optional[str] = Field(
        default=None,
        description=(
            "Reason represents a machine-readable description of why this validation"
            " failed. If this is the first validation in the list to fail, this reason,"
            " as well as the corresponding HTTP response code, are used in the HTTP"
            " response to the client. The currently supported reasons are:"
            ' "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". If not'
            " set, StatusReasonInvalid is used in the response to the client."
        ),
    )


class Variable(BaseModel):
    expression: str = Field(
        ...,
        description=(
            "Expression is the expression that will be evaluated as the value of the"
            " variable. The CEL expression has access to the same identifiers as the"
            " CEL expressions in Validation."
        ),
    )
    name: str = Field(
        ...,
        description=(
            "Name is the name of the variable. The name must be a valid CEL identifier"
            " and unique among all variables. The variable can be accessed in other"
            ' expressions through `variables` For example, if name is "foo", the'
            " variable will be available as `variables.foo`"
        ),
    )


class WebhookClientConfig(BaseModel):
    caBundle: Optional[str] = Field(
        default=None,
        description=(
            "`caBundle` is a PEM encoded CA bundle which will be used to validate the"
            " webhook's server certificate. If unspecified, system trust roots on the"
            " apiserver are used."
        ),
    )
    service: Optional[ServiceReference] = Field(
        default=None,
        description=(
            "`service` is a reference to the service for this webhook. Either `service`"
            " or `url` must be specified.\n\nIf the webhook is running within the"
            " cluster, then you should use `service`."
        ),
    )
    url: Optional[str] = Field(
        default=None,
        description=(
            "`url` gives the location of the webhook, in standard URL form"
            " (`scheme://host:port/path`). Exactly one of `url` or `service` must be"
            " specified.\n\nThe `host` should not refer to a service running in the"
            " cluster; use the `service` field instead. The host might be resolved via"
            " external DNS in some apiservers (e.g., `kube-apiserver` cannot resolve"
            " in-cluster DNS as that would be a layering violation). `host` may also be"
            " an IP address.\n\nPlease note that using `localhost` or `127.0.0.1` as a"
            " `host` is risky unless you take great care to run this webhook on all"
            " hosts which run an apiserver which might need to make calls to this"
            " webhook. Such installs are likely to be non-portable, i.e., not easy to"
            ' turn up in a new cluster.\n\nThe scheme must be "https"; the URL must'
            ' begin with "https://".\n\nA path is optional, and if present may be any'
            " string permissible in a URL. You may use the path to pass an arbitrary"
            " string to the webhook, for example, a cluster identifier.\n\nAttempting"
            ' to use a user or basic auth e.g. "user:password@" is not allowed.'
            ' Fragments ("#...") and query parameters ("?...") are not allowed, either.'
        ),
    )


class MatchResources(BaseModel):
    excludeResourceRules: Optional[List[NamedRuleWithOperations]] = Field(
        default=None,
        description=(
            "ExcludeResourceRules describes what operations on what"
            " resources/subresources the ValidatingAdmissionPolicy should not care"
            " about. The exclude rules take precedence over include rules (if a"
            " resource matches both, it is excluded)"
        ),
    )
    matchPolicy: Optional[str] = Field(
        default=None,
        description=(
            'matchPolicy defines how the "MatchResources" list is used to match'
            ' incoming requests. Allowed values are "Exact" or "Equivalent".\n\n-'
            " Exact: match a request only if it exactly matches a specified rule. For"
            " example, if deployments can be modified via apps/v1, apps/v1beta1, and"
            ' extensions/v1beta1, but "rules" only included `apiGroups:["apps"],'
            ' apiVersions:["v1"], resources: ["deployments"]`, a request to'
            " apps/v1beta1 or extensions/v1beta1 would not be sent to the"
            " ValidatingAdmissionPolicy.\n\n- Equivalent: match a request if modifies a"
            " resource listed in rules, even via another API group or version. For"
            " example, if deployments can be modified via apps/v1, apps/v1beta1, and"
            ' extensions/v1beta1, and "rules" only included `apiGroups:["apps"],'
            ' apiVersions:["v1"], resources: ["deployments"]`, a request to'
            " apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent"
            ' to the ValidatingAdmissionPolicy.\n\nDefaults to "Equivalent"'
        ),
    )
    namespaceSelector: Optional[v1.LabelSelector] = Field(
        default=None,
        description=(
            "NamespaceSelector decides whether to run the admission control policy on"
            " an object based on whether the namespace for that object matches the"
            " selector. If the object itself is a namespace, the matching is performed"
            " on object.metadata.labels. If the object is another cluster scoped"
            " resource, it never skips the policy.\n\nFor example, to run the webhook"
            ' on any objects whose namespace is not associated with "runlevel" of "0"'
            ' or "1";  you will set the selector as follows: "namespaceSelector": {\n '
            ' "matchExpressions": [\n    {\n      "key": "runlevel",\n      "operator":'
            ' "NotIn",\n      "values": [\n        "0",\n        "1"\n      ]\n    }\n '
            " ]\n}\n\nIf instead you want to only run the policy on any objects whose"
            ' namespace is associated with the "environment" of "prod" or "staging";'
            ' you will set the selector as follows: "namespaceSelector": {\n '
            ' "matchExpressions": [\n    {\n      "key": "environment",\n     '
            ' "operator": "In",\n      "values": [\n        "prod",\n       '
            ' "staging"\n      ]\n    }\n  ]\n}\n\nSee'
            " https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/"
            " for more examples of label selectors.\n\nDefault to the empty"
            " LabelSelector, which matches everything."
        ),
    )
    objectSelector: Optional[v1.LabelSelector] = Field(
        default=None,
        description=(
            "ObjectSelector decides whether to run the validation based on if the"
            " object has matching labels. objectSelector is evaluated against both the"
            " oldObject and newObject that would be sent to the cel validation, and is"
            " considered to match if either object matches the selector. A null object"
            " (oldObject in the case of create, or newObject in the case of delete) or"
            " an object that cannot have labels (like a DeploymentRollback or a"
            " PodProxyOptions object) is not considered to match. Use the object"
            " selector only if the webhook is opt-in, because end users may skip the"
            " admission webhook by setting the labels. Default to the empty"
            " LabelSelector, which matches everything."
        ),
    )
    resourceRules: Optional[List[NamedRuleWithOperations]] = Field(
        default=None,
        description=(
            "ResourceRules describes what operations on what resources/subresources the"
            " ValidatingAdmissionPolicy matches. The policy cares about an operation if"
            " it matches _any_ Rule."
        ),
    )


class MutatingWebhook(BaseModel):
    admissionReviewVersions: List[str] = Field(
        ...,
        description=(
            "AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`"
            " versions the Webhook expects. API server will try to use first version in"
            " the list which it supports. If none of the versions specified in this"
            " list supported by API server, validation will fail for this object. If a"
            " persisted webhook configuration specifies allowed versions and does not"
            " include any versions known to the API Server, calls to the webhook will"
            " fail and be subject to the failure policy."
        ),
    )
    clientConfig: WebhookClientConfig = Field(
        ...,
        description="ClientConfig defines how to communicate with the hook. Required",
    )
    failurePolicy: Optional[str] = Field(
        default=None,
        description=(
            "FailurePolicy defines how unrecognized errors from the admission endpoint"
            " are handled - allowed values are Ignore or Fail. Defaults to Fail."
        ),
    )
    matchConditions: Optional[List[MatchCondition]] = Field(
        default=None,
        description=(
            "MatchConditions is a list of conditions that must be met for a request to"
            " be sent to this webhook. Match conditions filter requests that have"
            " already been matched by the rules, namespaceSelector, and objectSelector."
            " An empty list of matchConditions matches all requests. There are a"
            " maximum of 64 match conditions allowed.\n\nThe exact matching logic is"
            " (in order):\n  1. If ANY matchCondition evaluates to FALSE, the webhook"
            " is skipped.\n  2. If ALL matchConditions evaluate to TRUE, the webhook is"
            " called.\n  3. If any matchCondition evaluates to an error (but none are"
            " FALSE):\n     - If failurePolicy=Fail, reject the request\n     - If"
            " failurePolicy=Ignore, the error is ignored and the webhook is skipped"
        ),
    )
    matchPolicy: Optional[str] = Field(
        default=None,
        description=(
            'matchPolicy defines how the "rules" list is used to match incoming'
            ' requests. Allowed values are "Exact" or "Equivalent".\n\n- Exact: match a'
            " request only if it exactly matches a specified rule. For example, if"
            " deployments can be modified via apps/v1, apps/v1beta1, and"
            ' extensions/v1beta1, but "rules" only included `apiGroups:["apps"],'
            ' apiVersions:["v1"], resources: ["deployments"]`, a request to'
            " apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.\n\n-"
            " Equivalent: match a request if modifies a resource listed in rules, even"
            " via another API group or version. For example, if deployments can be"
            ' modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules"'
            ' only included `apiGroups:["apps"], apiVersions:["v1"], resources:'
            ' ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would'
            " be converted to apps/v1 and sent to the webhook.\n\nDefaults to"
            ' "Equivalent"'
        ),
    )
    name: str = Field(
        ...,
        description=(
            "The name of the admission webhook. Name should be fully qualified, e.g.,"
            ' imagepolicy.kubernetes.io, where "imagepolicy" is the name of the'
            " webhook, and kubernetes.io is the name of the organization. Required."
        ),
    )
    namespaceSelector: Optional[v1.LabelSelector] = Field(
        default=None,
        description=(
            "NamespaceSelector decides whether to run the webhook on an object based on"
            " whether the namespace for that object matches the selector. If the object"
            " itself is a namespace, the matching is performed on"
            " object.metadata.labels. If the object is another cluster scoped resource,"
            " it never skips the webhook.\n\nFor example, to run the webhook on any"
            ' objects whose namespace is not associated with "runlevel" of "0" or "1"; '
            ' you will set the selector as follows: "namespaceSelector": {\n '
            ' "matchExpressions": [\n    {\n      "key": "runlevel",\n      "operator":'
            ' "NotIn",\n      "values": [\n        "0",\n        "1"\n      ]\n    }\n '
            " ]\n}\n\nIf instead you want to only run the webhook on any objects whose"
            ' namespace is associated with the "environment" of "prod" or "staging";'
            ' you will set the selector as follows: "namespaceSelector": {\n '
            ' "matchExpressions": [\n    {\n      "key": "environment",\n     '
            ' "operator": "In",\n      "values": [\n        "prod",\n       '
            ' "staging"\n      ]\n    }\n  ]\n}\n\nSee'
            " https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/"
            " for more examples of label selectors.\n\nDefault to the empty"
            " LabelSelector, which matches everything."
        ),
    )
    objectSelector: Optional[v1.LabelSelector] = Field(
        default=None,
        description=(
            "ObjectSelector decides whether to run the webhook based on if the object"
            " has matching labels. objectSelector is evaluated against both the"
            " oldObject and newObject that would be sent to the webhook, and is"
            " considered to match if either object matches the selector. A null object"
            " (oldObject in the case of create, or newObject in the case of delete) or"
            " an object that cannot have labels (like a DeploymentRollback or a"
            " PodProxyOptions object) is not considered to match. Use the object"
            " selector only if the webhook is opt-in, because end users may skip the"
            " admission webhook by setting the labels. Default to the empty"
            " LabelSelector, which matches everything."
        ),
    )
    reinvocationPolicy: Optional[str] = Field(
        default=None,
        description=(
            "reinvocationPolicy indicates whether this webhook should be called"
            " multiple times as part of a single admission evaluation. Allowed values"
            ' are "Never" and "IfNeeded".\n\nNever: the webhook will not be called more'
            " than once in a single admission evaluation.\n\nIfNeeded: the webhook will"
            " be called at least one additional time as part of the admission"
            " evaluation if the object being admitted is modified by other admission"
            " plugins after the initial webhook call. Webhooks that specify this option"
            " *must* be idempotent, able to process objects they previously admitted."
            " Note: * the number of additional invocations is not guaranteed to be"
            " exactly one. * if additional invocations result in further modifications"
            " to the object, webhooks are not guaranteed to be invoked again. *"
            " webhooks that use this option may be reordered to minimize the number of"
            " additional invocations. * to validate an object after all mutations are"
            " guaranteed complete, use a validating admission webhook"
            ' instead.\n\nDefaults to "Never".'
        ),
    )
    rules: Optional[List[RuleWithOperations]] = Field(
        default=None,
        description=(
            "Rules describes what operations on what resources/subresources the webhook"
            " cares about. The webhook cares about an operation if it matches _any_"
            " Rule. However, in order to prevent ValidatingAdmissionWebhooks and"
            " MutatingAdmissionWebhooks from putting the cluster in a state which"
            " cannot be recovered from without completely disabling the plugin,"
            " ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never"
            " called on admission requests for ValidatingWebhookConfiguration and"
            " MutatingWebhookConfiguration objects."
        ),
    )
    sideEffects: str = Field(
        ...,
        description=(
            "SideEffects states whether this webhook has side effects. Acceptable"
            " values are: None, NoneOnDryRun (webhooks created via v1beta1 may also"
            " specify Some or Unknown). Webhooks with side effects MUST implement a"
            " reconciliation system, since a request may be rejected by a future step"
            " in the admission chain and the side effects therefore need to be undone."
            " Requests with the dryRun attribute will be auto-rejected if they match a"
            " webhook with sideEffects == Unknown or Some."
        ),
    )
    timeoutSeconds: Optional[int] = Field(
        default=None,
        description=(
            "TimeoutSeconds specifies the timeout for this webhook. After the timeout"
            " passes, the webhook call will be ignored or the API call will fail based"
            " on the failure policy. The timeout value must be between 1 and 30"
            " seconds. Default to 10 seconds."
        ),
    )


class MutatingWebhookConfiguration(BaseModel):
    apiVersion: Optional[str] = Field(
        default="admissionregistration.k8s.io/v1",
        description=(
            "APIVersion defines the versioned schema of this representation of an"
            " object. Servers should convert recognized schemas to the latest internal"
            " value, and may reject unrecognized values. More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
        ),
    )
    kind: Optional[str] = Field(
        default="MutatingWebhookConfiguration",
        description=(
            "Kind is a string value representing the REST resource this object"
            " represents. Servers may infer this from the endpoint the client submits"
            " requests to. Cannot be updated. In CamelCase. More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
        ),
    )
    metadata: Optional[v1.ObjectMeta] = Field(
        default=None,
        description=(
            "Standard object metadata; More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata."
        ),
    )
    webhooks: Optional[List[MutatingWebhook]] = Field(
        default=None,
        description=(
            "Webhooks is a list of webhooks and the affected resources and operations."
        ),
    )


class MutatingWebhookConfigurationList(BaseModel):
    apiVersion: Optional[str] = Field(
        default="admissionregistration.k8s.io/v1",
        description=(
            "APIVersion defines the versioned schema of this representation of an"
            " object. Servers should convert recognized schemas to the latest internal"
            " value, and may reject unrecognized values. More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
        ),
    )
    items: List[MutatingWebhookConfiguration] = Field(
        ..., description="List of MutatingWebhookConfiguration."
    )
    kind: Optional[str] = Field(
        default="MutatingWebhookConfigurationList",
        description=(
            "Kind is a string value representing the REST resource this object"
            " represents. Servers may infer this from the endpoint the client submits"
            " requests to. Cannot be updated. In CamelCase. More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
        ),
    )
    metadata: Optional[v1.ListMeta] = Field(
        default=None,
        description=(
            "Standard list metadata. More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
        ),
    )


class ParamRef(BaseModel):
    name: Optional[str] = Field(
        default=None,
        description=(
            "name is the name of the resource being referenced.\n\nOne of `name` or"
            " `selector` must be set, but `name` and `selector` are mutually exclusive"
            " properties. If one is set, the other must be unset.\n\nA single parameter"
            " used for all admission requests can be configured by setting the `name`"
            " field, leaving `selector` blank, and setting namespace if `paramKind` is"
            " namespace-scoped."
        ),
    )
    namespace: Optional[str] = Field(
        default=None,
        description=(
            "namespace is the namespace of the referenced resource. Allows limiting the"
            " search for params to a specific namespace. Applies to both `name` and"
            " `selector` fields.\n\nA per-namespace parameter may be used by specifying"
            " a namespace-scoped `paramKind` in the policy and leaving this field"
            " empty.\n\n- If `paramKind` is cluster-scoped, this field MUST be unset."
            " Setting this field results in a configuration error.\n\n- If `paramKind`"
            " is namespace-scoped, the namespace of the object being evaluated for"
            " admission will be used when this field is left unset. Take care that if"
            " this is left empty the binding must not match any cluster-scoped"
            " resources, which will result in an error."
        ),
    )
    parameterNotFoundAction: Optional[str] = Field(
        default=None,
        description=(
            "`parameterNotFoundAction` controls the behavior of the binding when the"
            " resource exists, and name or selector is valid, but there are no"
            " parameters matched by the binding. If the value is set to `Allow`, then"
            " no matched parameters will be treated as successful validation by the"
            " binding. If set to `Deny`, then no matched parameters will be subject to"
            " the `failurePolicy` of the policy.\n\nAllowed values are `Allow` or"
            " `Deny`\n\nRequired"
        ),
    )
    selector: Optional[v1.LabelSelector] = Field(
        default=None,
        description=(
            "selector can be used to match multiple param objects based on their"
            " labels. Supply selector: {} to match all resources of the"
            " ParamKind.\n\nIf multiple params are found, they are all evaluated with"
            " the policy expressions and the results are ANDed together.\n\nOne of"
            " `name` or `selector` must be set, but `name` and `selector` are mutually"
            " exclusive properties. If one is set, the other must be unset."
        ),
    )


class ValidatingAdmissionPolicyBindingSpec(BaseModel):
    matchResources: Optional[MatchResources] = Field(
        default=None,
        description=(
            "MatchResources declares what resources match this binding and will be"
            " validated by it. Note that this is intersected with the policy's"
            " matchConstraints, so only requests that are matched by the policy can be"
            " selected by this. If this is unset, all resources matched by the policy"
            " are validated by this binding When resourceRules is unset, it does not"
            " constrain resource matching. If a resource is matched by the other fields"
            " of this object, it will be validated. Note that this is differs from"
            " ValidatingAdmissionPolicy matchConstraints, where resourceRules are"
            " required."
        ),
    )
    paramRef: Optional[ParamRef] = Field(
        default=None,
        description=(
            "paramRef specifies the parameter resource used to configure the admission"
            " control policy. It should point to a resource of the type specified in"
            " ParamKind of the bound ValidatingAdmissionPolicy. If the policy specifies"
            " a ParamKind and the resource referred to by ParamRef does not exist, this"
            " binding is considered mis-configured and the FailurePolicy of the"
            " ValidatingAdmissionPolicy applied. If the policy does not specify a"
            " ParamKind then this field is ignored, and the rules are evaluated without"
            " a param."
        ),
    )
    policyName: Optional[str] = Field(
        default=None,
        description=(
            "PolicyName references a ValidatingAdmissionPolicy name which the"
            " ValidatingAdmissionPolicyBinding binds to. If the referenced resource"
            " does not exist, this binding is considered invalid and will be ignored"
            " Required."
        ),
    )
    validationActions: Optional[List[str]] = Field(
        default=None,
        description=(
            "validationActions declares how Validations of the referenced"
            " ValidatingAdmissionPolicy are enforced. If a validation evaluates to"
            " false it is always enforced according to these actions.\n\nFailures"
            " defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced"
            " according to these actions only if the FailurePolicy is set to Fail,"
            " otherwise the failures are ignored. This includes compilation errors,"
            " runtime errors and misconfigurations of the policy.\n\nvalidationActions"
            " is declared as a set of action values. Order does not matter."
            " validationActions may not contain duplicates of the same action.\n\nThe"
            ' supported actions values are:\n\n"Deny" specifies that a validation'
            ' failure results in a denied request.\n\n"Warn" specifies that a'
            " validation failure is reported to the request client in HTTP Warning"
            " headers, with a warning code of 299. Warnings can be sent both for"
            ' allowed or denied admission responses.\n\n"Audit" specifies that a'
            " validation failure is included in the published audit event for the"
            " request. The audit event will contain a"
            " `validation.policy.admission.k8s.io/validation_failure` audit annotation"
            " with a value containing the details of the validation failures, formatted"
            " as a JSON list of objects, each with the following fields: - message: The"
            " validation failure message string - policy: The resource name of the"
            " ValidatingAdmissionPolicy - binding: The resource name of the"
            " ValidatingAdmissionPolicyBinding - expressionIndex: The index of the"
            " failed validations in the ValidatingAdmissionPolicy - validationActions:"
            " The enforcement actions enacted for the validation failure Example audit"
            ' annotation: `"validation.policy.admission.k8s.io/validation_failure":'
            ' "[{"message": "Invalid value", {"policy": "policy.example.com",'
            ' {"binding": "policybinding.example.com", {"expressionIndex": "1",'
            ' {"validationActions": ["Audit"]}]"`\n\nClients should expect to handle'
            ' additional values by ignoring any values not recognized.\n\n"Deny" and'
            ' "Warn" may not be used together since this combination needlessly'
            " duplicates the validation failure both in the API response body and the"
            " HTTP warning headers.\n\nRequired."
        ),
    )


class ValidatingAdmissionPolicySpec(BaseModel):
    auditAnnotations: Optional[List[AuditAnnotation]] = Field(
        default=None,
        description=(
            "auditAnnotations contains CEL expressions which are used to produce audit"
            " annotations for the audit event of the API request. validations and"
            " auditAnnotations may not both be empty; a least one of validations or"
            " auditAnnotations is required."
        ),
    )
    failurePolicy: Optional[str] = Field(
        default=None,
        description=(
            "failurePolicy defines how to handle failures for the admission policy."
            " Failures can occur from CEL expression parse errors, type check errors,"
            " runtime errors and invalid or mis-configured policy definitions or"
            " bindings.\n\nA policy is invalid if spec.paramKind refers to a"
            " non-existent Kind. A binding is invalid if spec.paramRef.name refers to a"
            " non-existent resource.\n\nfailurePolicy does not define how validations"
            " that evaluate to false are handled.\n\nWhen failurePolicy is set to Fail,"
            " ValidatingAdmissionPolicyBinding validationActions define how failures"
            " are enforced.\n\nAllowed values are Ignore or Fail. Defaults to Fail."
        ),
    )
    matchConditions: Optional[List[MatchCondition]] = Field(
        default=None,
        description=(
            "MatchConditions is a list of conditions that must be met for a request to"
            " be validated. Match conditions filter requests that have already been"
            " matched by the rules, namespaceSelector, and objectSelector. An empty"
            " list of matchConditions matches all requests. There are a maximum of 64"
            " match conditions allowed.\n\nIf a parameter object is provided, it can be"
            " accessed via the `params` handle in the same manner as validation"
            " expressions.\n\nThe exact matching logic is (in order):\n  1. If ANY"
            " matchCondition evaluates to FALSE, the policy is skipped.\n  2. If ALL"
            " matchConditions evaluate to TRUE, the policy is evaluated.\n  3. If any"
            " matchCondition evaluates to an error (but none are FALSE):\n     - If"
            " failurePolicy=Fail, reject the request\n     - If failurePolicy=Ignore,"
            " the policy is skipped"
        ),
    )
    matchConstraints: Optional[MatchResources] = Field(
        default=None,
        description=(
            "MatchConstraints specifies what resources this policy is designed to"
            " validate. The AdmissionPolicy cares about a request if it matches _all_"
            " Constraints. However, in order to prevent clusters from being put into an"
            " unstable state that cannot be recovered from via the API"
            " ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and"
            " ValidatingAdmissionPolicyBinding. Required."
        ),
    )
    paramKind: Optional[ParamKind] = Field(
        default=None,
        description=(
            "ParamKind specifies the kind of resources used to parameterize this"
            " policy. If absent, there are no parameters for this policy and the param"
            " CEL variable will not be provided to validation expressions. If ParamKind"
            " refers to a non-existent kind, this policy definition is mis-configured"
            " and the FailurePolicy is applied. If paramKind is specified but paramRef"
            " is unset in ValidatingAdmissionPolicyBinding, the params variable will be"
            " null."
        ),
    )
    validations: Optional[List[Validation]] = Field(
        default=None,
        description=(
            "Validations contain CEL expressions which is used to apply the validation."
            " Validations and AuditAnnotations may not both be empty; a minimum of one"
            " Validations or AuditAnnotations is required."
        ),
    )
    variables: Optional[List[Variable]] = Field(
        default=None,
        description=(
            "Variables contain definitions of variables that can be used in composition"
            " of other expressions. Each variable is defined as a named CEL expression."
            " The variables defined here will be available under `variables` in other"
            " expressions of the policy except MatchConditions because MatchConditions"
            " are evaluated before the rest of the policy.\n\nThe expression of a"
            " variable can refer to other variables defined earlier in the list but not"
            " those after. Thus, Variables must be sorted by the order of first"
            " appearance and acyclic."
        ),
    )


class ValidatingAdmissionPolicyStatus(BaseModel):
    conditions: Optional[List[v1.Condition]] = Field(
        default=None,
        description=(
            "The conditions represent the latest available observations of a policy's"
            " current state."
        ),
    )
    observedGeneration: Optional[int] = Field(
        default=None, description="The generation observed by the controller."
    )
    typeChecking: Optional[TypeChecking] = Field(
        default=None,
        description=(
            "The results of type checking for each expression. Presence of this field"
            " indicates the completion of the type checking."
        ),
    )


class ValidatingWebhook(BaseModel):
    admissionReviewVersions: List[str] = Field(
        ...,
        description=(
            "AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`"
            " versions the Webhook expects. API server will try to use first version in"
            " the list which it supports. If none of the versions specified in this"
            " list supported by API server, validation will fail for this object. If a"
            " persisted webhook configuration specifies allowed versions and does not"
            " include any versions known to the API Server, calls to the webhook will"
            " fail and be subject to the failure policy."
        ),
    )
    clientConfig: WebhookClientConfig = Field(
        ...,
        description="ClientConfig defines how to communicate with the hook. Required",
    )
    failurePolicy: Optional[str] = Field(
        default=None,
        description=(
            "FailurePolicy defines how unrecognized errors from the admission endpoint"
            " are handled - allowed values are Ignore or Fail. Defaults to Fail."
        ),
    )
    matchConditions: Optional[List[MatchCondition]] = Field(
        default=None,
        description=(
            "MatchConditions is a list of conditions that must be met for a request to"
            " be sent to this webhook. Match conditions filter requests that have"
            " already been matched by the rules, namespaceSelector, and objectSelector."
            " An empty list of matchConditions matches all requests. There are a"
            " maximum of 64 match conditions allowed.\n\nThe exact matching logic is"
            " (in order):\n  1. If ANY matchCondition evaluates to FALSE, the webhook"
            " is skipped.\n  2. If ALL matchConditions evaluate to TRUE, the webhook is"
            " called.\n  3. If any matchCondition evaluates to an error (but none are"
            " FALSE):\n     - If failurePolicy=Fail, reject the request\n     - If"
            " failurePolicy=Ignore, the error is ignored and the webhook is skipped"
        ),
    )
    matchPolicy: Optional[str] = Field(
        default=None,
        description=(
            'matchPolicy defines how the "rules" list is used to match incoming'
            ' requests. Allowed values are "Exact" or "Equivalent".\n\n- Exact: match a'
            " request only if it exactly matches a specified rule. For example, if"
            " deployments can be modified via apps/v1, apps/v1beta1, and"
            ' extensions/v1beta1, but "rules" only included `apiGroups:["apps"],'
            ' apiVersions:["v1"], resources: ["deployments"]`, a request to'
            " apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.\n\n-"
            " Equivalent: match a request if modifies a resource listed in rules, even"
            " via another API group or version. For example, if deployments can be"
            ' modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules"'
            ' only included `apiGroups:["apps"], apiVersions:["v1"], resources:'
            ' ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would'
            " be converted to apps/v1 and sent to the webhook.\n\nDefaults to"
            ' "Equivalent"'
        ),
    )
    name: str = Field(
        ...,
        description=(
            "The name of the admission webhook. Name should be fully qualified, e.g.,"
            ' imagepolicy.kubernetes.io, where "imagepolicy" is the name of the'
            " webhook, and kubernetes.io is the name of the organization. Required."
        ),
    )
    namespaceSelector: Optional[v1.LabelSelector] = Field(
        default=None,
        description=(
            "NamespaceSelector decides whether to run the webhook on an object based on"
            " whether the namespace for that object matches the selector. If the object"
            " itself is a namespace, the matching is performed on"
            " object.metadata.labels. If the object is another cluster scoped resource,"
            " it never skips the webhook.\n\nFor example, to run the webhook on any"
            ' objects whose namespace is not associated with "runlevel" of "0" or "1"; '
            ' you will set the selector as follows: "namespaceSelector": {\n '
            ' "matchExpressions": [\n    {\n      "key": "runlevel",\n      "operator":'
            ' "NotIn",\n      "values": [\n        "0",\n        "1"\n      ]\n    }\n '
            " ]\n}\n\nIf instead you want to only run the webhook on any objects whose"
            ' namespace is associated with the "environment" of "prod" or "staging";'
            ' you will set the selector as follows: "namespaceSelector": {\n '
            ' "matchExpressions": [\n    {\n      "key": "environment",\n     '
            ' "operator": "In",\n      "values": [\n        "prod",\n       '
            ' "staging"\n      ]\n    }\n  ]\n}\n\nSee'
            " https://kubernetes.io/docs/concepts/overview/working-with-objects/labels"
            " for more examples of label selectors.\n\nDefault to the empty"
            " LabelSelector, which matches everything."
        ),
    )
    objectSelector: Optional[v1.LabelSelector] = Field(
        default=None,
        description=(
            "ObjectSelector decides whether to run the webhook based on if the object"
            " has matching labels. objectSelector is evaluated against both the"
            " oldObject and newObject that would be sent to the webhook, and is"
            " considered to match if either object matches the selector. A null object"
            " (oldObject in the case of create, or newObject in the case of delete) or"
            " an object that cannot have labels (like a DeploymentRollback or a"
            " PodProxyOptions object) is not considered to match. Use the object"
            " selector only if the webhook is opt-in, because end users may skip the"
            " admission webhook by setting the labels. Default to the empty"
            " LabelSelector, which matches everything."
        ),
    )
    rules: Optional[List[RuleWithOperations]] = Field(
        default=None,
        description=(
            "Rules describes what operations on what resources/subresources the webhook"
            " cares about. The webhook cares about an operation if it matches _any_"
            " Rule. However, in order to prevent ValidatingAdmissionWebhooks and"
            " MutatingAdmissionWebhooks from putting the cluster in a state which"
            " cannot be recovered from without completely disabling the plugin,"
            " ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never"
            " called on admission requests for ValidatingWebhookConfiguration and"
            " MutatingWebhookConfiguration objects."
        ),
    )
    sideEffects: str = Field(
        ...,
        description=(
            "SideEffects states whether this webhook has side effects. Acceptable"
            " values are: None, NoneOnDryRun (webhooks created via v1beta1 may also"
            " specify Some or Unknown). Webhooks with side effects MUST implement a"
            " reconciliation system, since a request may be rejected by a future step"
            " in the admission chain and the side effects therefore need to be undone."
            " Requests with the dryRun attribute will be auto-rejected if they match a"
            " webhook with sideEffects == Unknown or Some."
        ),
    )
    timeoutSeconds: Optional[int] = Field(
        default=None,
        description=(
            "TimeoutSeconds specifies the timeout for this webhook. After the timeout"
            " passes, the webhook call will be ignored or the API call will fail based"
            " on the failure policy. The timeout value must be between 1 and 30"
            " seconds. Default to 10 seconds."
        ),
    )


class ValidatingWebhookConfiguration(BaseModel):
    apiVersion: Optional[str] = Field(
        default="admissionregistration.k8s.io/v1",
        description=(
            "APIVersion defines the versioned schema of this representation of an"
            " object. Servers should convert recognized schemas to the latest internal"
            " value, and may reject unrecognized values. More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
        ),
    )
    kind: Optional[str] = Field(
        default="ValidatingWebhookConfiguration",
        description=(
            "Kind is a string value representing the REST resource this object"
            " represents. Servers may infer this from the endpoint the client submits"
            " requests to. Cannot be updated. In CamelCase. More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
        ),
    )
    metadata: Optional[v1.ObjectMeta] = Field(
        default=None,
        description=(
            "Standard object metadata; More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata."
        ),
    )
    webhooks: Optional[List[ValidatingWebhook]] = Field(
        default=None,
        description=(
            "Webhooks is a list of webhooks and the affected resources and operations."
        ),
    )


class ValidatingWebhookConfigurationList(BaseModel):
    apiVersion: Optional[str] = Field(
        default="admissionregistration.k8s.io/v1",
        description=(
            "APIVersion defines the versioned schema of this representation of an"
            " object. Servers should convert recognized schemas to the latest internal"
            " value, and may reject unrecognized values. More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
        ),
    )
    items: List[ValidatingWebhookConfiguration] = Field(
        ..., description="List of ValidatingWebhookConfiguration."
    )
    kind: Optional[str] = Field(
        default="ValidatingWebhookConfigurationList",
        description=(
            "Kind is a string value representing the REST resource this object"
            " represents. Servers may infer this from the endpoint the client submits"
            " requests to. Cannot be updated. In CamelCase. More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
        ),
    )
    metadata: Optional[v1.ListMeta] = Field(
        default=None,
        description=(
            "Standard list metadata. More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
        ),
    )


class ValidatingAdmissionPolicy(BaseModel):
    apiVersion: Optional[str] = Field(
        default="admissionregistration.k8s.io/v1",
        description=(
            "APIVersion defines the versioned schema of this representation of an"
            " object. Servers should convert recognized schemas to the latest internal"
            " value, and may reject unrecognized values. More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
        ),
    )
    kind: Optional[str] = Field(
        default="ValidatingAdmissionPolicy",
        description=(
            "Kind is a string value representing the REST resource this object"
            " represents. Servers may infer this from the endpoint the client submits"
            " requests to. Cannot be updated. In CamelCase. More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
        ),
    )
    metadata: Optional[v1.ObjectMeta] = Field(
        default=None,
        description=(
            "Standard object metadata; More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata."
        ),
    )
    spec: Optional[ValidatingAdmissionPolicySpec] = Field(
        default=None,
        description=(
            "Specification of the desired behavior of the ValidatingAdmissionPolicy."
        ),
    )
    status: Optional[ValidatingAdmissionPolicyStatus] = Field(
        default=None,
        description=(
            "The status of the ValidatingAdmissionPolicy, including warnings that are"
            " useful to determine if the policy behaves in the expected way. Populated"
            " by the system. Read-only."
        ),
    )


class ValidatingAdmissionPolicyBinding(BaseModel):
    apiVersion: Optional[str] = Field(
        default="admissionregistration.k8s.io/v1",
        description=(
            "APIVersion defines the versioned schema of this representation of an"
            " object. Servers should convert recognized schemas to the latest internal"
            " value, and may reject unrecognized values. More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
        ),
    )
    kind: Optional[str] = Field(
        default="ValidatingAdmissionPolicyBinding",
        description=(
            "Kind is a string value representing the REST resource this object"
            " represents. Servers may infer this from the endpoint the client submits"
            " requests to. Cannot be updated. In CamelCase. More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
        ),
    )
    metadata: Optional[v1.ObjectMeta] = Field(
        default=None,
        description=(
            "Standard object metadata; More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata."
        ),
    )
    spec: Optional[ValidatingAdmissionPolicyBindingSpec] = Field(
        default=None,
        description=(
            "Specification of the desired behavior of the"
            " ValidatingAdmissionPolicyBinding."
        ),
    )


class ValidatingAdmissionPolicyBindingList(BaseModel):
    apiVersion: Optional[str] = Field(
        default="admissionregistration.k8s.io/v1",
        description=(
            "APIVersion defines the versioned schema of this representation of an"
            " object. Servers should convert recognized schemas to the latest internal"
            " value, and may reject unrecognized values. More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
        ),
    )
    items: Optional[List[ValidatingAdmissionPolicyBinding]] = Field(
        default=None, description="List of PolicyBinding."
    )
    kind: Optional[str] = Field(
        default="ValidatingAdmissionPolicyBindingList",
        description=(
            "Kind is a string value representing the REST resource this object"
            " represents. Servers may infer this from the endpoint the client submits"
            " requests to. Cannot be updated. In CamelCase. More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
        ),
    )
    metadata: Optional[v1.ListMeta] = Field(
        default=None,
        description=(
            "Standard list metadata. More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
        ),
    )


class ValidatingAdmissionPolicyList(BaseModel):
    apiVersion: Optional[str] = Field(
        default="admissionregistration.k8s.io/v1",
        description=(
            "APIVersion defines the versioned schema of this representation of an"
            " object. Servers should convert recognized schemas to the latest internal"
            " value, and may reject unrecognized values. More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
        ),
    )
    items: Optional[List[ValidatingAdmissionPolicy]] = Field(
        default=None, description="List of ValidatingAdmissionPolicy."
    )
    kind: Optional[str] = Field(
        default="ValidatingAdmissionPolicyList",
        description=(
            "Kind is a string value representing the REST resource this object"
            " represents. Servers may infer this from the endpoint the client submits"
            " requests to. Cannot be updated. In CamelCase. More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
        ),
    )
    metadata: Optional[v1.ListMeta] = Field(
        default=None,
        description=(
            "Standard list metadata. More info:"
            " https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
        ),
    )
